Key points
- Citrix confirmed active exploitation of CVE-2026-88771 on unmitigated NetScaler ADC and Gateway appliances worldwide.
- The vulnerability allows unauthenticated remote code execution, carrying a CVSS v3.1 score of 9.8 and v4.0 score of 9.5.
- Zscaler ThreatLabz observed a multi-stage attack chain involving log poisoning, web shells, and FreeBSD x64 implants.
On 27 September 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution flaw in NetScaler Application Delivery Controller and NetScaler Gateway. The vendor confirmed that attackers have successfully exploited unmitigated appliances globally, allowing them to run arbitrary commands without authentication.
Zscaler ThreatLabz researchers observed a complex exploitation chain that included access-log poisoning, pre-authentication command execution, and appliance fingerprinting. Attackers attempted to deploy multiple web shells and delivered a FreeBSD x64 implant. The infrastructure used overlapped with previous StyleSmuggler exploitation, though this does not confirm actor attribution.
Scope of impact
The vulnerability affects NetScaler ADC and NetScaler Gateway without requiring any optional features to be enabled. CISA added CVE-2026-88771 to its Known Exploited Vulnerabilities catalog following reports of active worldwide exploitation. Citrix also disclosed CVE-2026-107406, another critical flaw affecting SAML-configured appliances, but this analysis focuses on the primary RCE issue.
What happens next
Citrix recommends immediate updates to specific builds, including NetScaler 14.1-73.46 and 13.1-64.29, or later versions. Users should identify exposed appliances and preserve forensic evidence, such as syslog data and core dumps, before patching. Isolating compromised devices from untrusted networks is advised while investigating configuration changes.
Why this attack works
This incident illustrates how unauthenticated remote code execution flaws bypass initial access controls entirely. Attackers exploit the weakness to gain immediate command-line access, often using log poisoning to hide their tracks. Teams usually monitor for unexpected shell processes and anomalous HTTP requests. Check whether default service accounts have spawned child processes, as this indicates post-exploitation activity.
What to do and how to stay safe
- Inventory all NetScaler ADC and Gateway appliances to verify software versions against Citrix’s recommended build list.
- Preserve forensic evidence, including virtual machine snapshots and syslog data, before applying any updates or patches.
- Isolate potentially compromised appliances from untrusted networks to prevent lateral movement or data exfiltration.
- Search HTTP access logs for specific User-Agent values and Base
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
